I came across a story about how North Korean hackers from the Lazarus Group stole $620 million in crypto with just one click. And the wildest part is—they didn’t hack the code; they simply tricked someone.
The scheme was genius:
• They found a senior engineer at the blockchain game Axie Infinity on LinkedIn.
• For a month, they strung him along with fake interviews, then offered him a “dream job” with an astronomical salary.
• Finally, they sent him what they claimed was a contract in PDF format.
The engineer clicked “download,” got infected with a virus, and the hackers gained access to the network. They took control of the validator keys and quietly withdrew 173,000 Ethereum.
What’s more, the company was so confident in its security that it didn’t notice the theft for six days—until an ordinary player couldn’t withdraw their money because the cash pool was empty.
Moral of the story: no matter how impressive your security is, the weakest link is always the person who really wants to change jobs 😂
The scheme was genius:
• They found a senior engineer at the blockchain game Axie Infinity on LinkedIn.
• For a month, they strung him along with fake interviews, then offered him a “dream job” with an astronomical salary.
• Finally, they sent him what they claimed was a contract in PDF format.
The engineer clicked “download,” got infected with a virus, and the hackers gained access to the network. They took control of the validator keys and quietly withdrew 173,000 Ethereum.
What’s more, the company was so confident in its security that it didn’t notice the theft for six days—until an ordinary player couldn’t withdraw their money because the cash pool was empty.
Moral of the story: no matter how impressive your security is, the weakest link is always the person who really wants to change jobs 😂
